300-710 — frequently asked questions

An IP address on the BVI is mandatory for it to pass traffic, but that address is what makes the BVI routable. Without a separate VRF, traffic can still be forwarded to other interfaces via the global routing table.

No. Physical interfaces that are members of a bridge group are Layer 2 ports and do not hold IP addresses, so there is nothing to remove. Routing is decided at the BVI, which is why the VRF approach is used.

Active/standby keeps only one chassis forwarding at a time, so it fails the requirement that both firewalls pass traffic and provides no separate logical firewall per department.

No; subinterfaces can separate traffic on one FTD, but the scenario needs independent firewall instances so each department's policy and forwarding domain are isolated.

FMC logs every triggered intrusion rule, then downgrades the impact level when the network map shows the target host lacks the vulnerable OS, service, or port the rule targets.

No. It means FMC sees no vulnerable target for that signature; if discovery later reveals the host as vulnerable, the impact level can change.

The Advanced Settings checkbox only shows TID is enabled on that policy. It does not confirm the new sources downloaded indicators or that they were published to the Threat Defense devices.

On the Threat Intelligence Director Sources page, the source status indicator and indicator count show whether each configured feed was retrieved successfully and whether it has been published to sensors.

File policies are attached to access control rules that allow traffic, not to the access control policy itself, and they cannot decrypt TLS. The question asks what is associated with the access control policy.

Yes. Decryption exposes the files, but the Allow rule must still reference a file policy with Malware Cloud Lookup and Block Malware so the files are actually inspected and blocked.

It bypasses the validation step and may override URL filtering or other policy intent; connection events show which rule or category actually blocked the traffic before you change the policy.

Packet capture can confirm a block, but setting a rule to monitor only logs traffic and does not represent a targeted fix; option B's connection-event review is the proper troubleshooting step.

In FMC port objects, the port field is mandatory for TCP/UDP; you must enter 1–65535 to cover all ports, as confirmed by official documentation.

A port object matches TCP/UDP ports, while an IP protocol object (option D) matches the IP protocol number (e.g., 17 for UDP) but cannot specify individual ports.

Snort fail open only passes traffic when the Snort process fails; it does not protect against power loss or hardware failure, which hardware bypass is designed to cover.

Passive mode avoids inline failure by receiving a SPAN, RSPAN, or ERSPAN copy, but it cannot block traffic inline, so it does not satisfy the IPS-at-the-perimeter premise.

Cisco documents hardware bypass for certain interface modules on Firepower 9300, 4100, and 2100 series appliances, so verify platform support before relying on it.

Deployment failures are generated and logged by the FMC policy compilation engine, so the FMC troubleshoot file contains the relevant error details for TAC.

Use FTD show tech for device-level issues such as data plane problems, crashes, or CLI errors, not for FMC-side deployment failures.

Packet Tracer only injects one simulated packet to show how policy would treat it, so it cannot reveal the real drops or session resets an overloaded FTD is causing.

No. The native tools are Packet Capture and Packet Tracer in FMC; export is just the step that downloads a capture file, and packet analysis is done externally in a tool like Wireshark.

All nodes in an FTD cluster share one configuration, so spanned EtherChannel load-balances traffic but cannot give each department its own isolated policy domain.

No. In active/standby only one unit forwards traffic, so it fails the requirement that both firewalls be actively passing traffic.

Transparent mode only bridges within the same subnet; it cannot route between inside and outside networks, so Internet traffic would need an external router, unlike option B.

Yes — FTD supports Integrated Routing and Bridging, so a BVI forwards same-subnet traffic while routed interfaces handle traffic to other networks.

Inline tap still places the sensor in the live packet path; Cisco's documented monitor-only deployment for collecting baseline data with no traffic impact is promiscuous mode.

Yes. Enforcement requires reconfiguring the sensor into an inline interface or inline VLAN pair, which is why the stem says the appliance will be reconfigured to drop later.

ERSPAN arrives as GRE-encapsulated copies that must be terminated by an IP-addressed interface with a flow ID and source IP; a transparent (Layer 2) FTD has no such interface, so only routed mode supports ERSPAN.

No. A passive/ERSPAN passive interface and a matching monitor session ID are valid as long as the FTD is routed; the stated transparent mode is the actual blocker.

A stateful link is optional; stateful failover can run over the regular failover link. The question asks for an action that must be taken, and the virtual MAC address is the mandatory feature that ensures failover transparency.

No, the virtual MAC address ensures L2 continuity and prevents MAC table relearning delays. Session preservation requires stateful failover, which can be configured optionally but is not the mandatory action for seamlessness.

Although a pxGrid client can publish topics, ISE lists FMC as a client (typically a subscriber) in Client Management; publisher is a capability, not FMC's assigned role.

Cisco ISE is always the pxGrid controller; it trusts participants and issues certificates. FMC is one of those participants, registering as a client.

An active registration status confirms the FMC can reach Threat Grid, so the failure is a local submission restriction such as a host limit, not a network outage (option D).

It means the FMC device is still successfully registered with the analysis service, ruling out on-prem or cloud connectivity failures (options A and D).

Predefined FMC reports are scoped to one event family — the Attacks Risk Report summarizes IPS impact-flag data only — so they cannot include malware or security intelligence events.

You choose a report template and add sections, each section a query against a specific event type such as intrusion, malware, or security intelligence, then run or schedule it.

FMC creates new access control rules in an enabled state, so a freshly defined rule is already active; you would have to disable it manually for it to stop being evaluated.

No. Hit counters increment whenever a connection matches the rule, while logging settings only control whether connection events are recorded for that already-matching traffic.

Allow sends matching traffic to Snort inspection, which can interfere with IKE and ESP. Switching to Trust bypasses Snort so the tunnel can establish.

No, ESP uses IP protocol 50 and has no ports, so PAT cannot translate or forward it. You need static NAT or direct routing for the VPN peer.

The router performs port address translation, so the private address is not routable from the FMC and no inbound mapping exists. Registration must instead be matched by a shared NAT ID.

PAT assigns source ports dynamically per flow, so the port is not a stable identifier. The FMC authenticates the device with the NAT ID and registration key, not an address-plus-port pair.

It is optional, but configuring it before deployment ensures each container instance interface receives a unique virtual MAC address instead of a default one.

Assigning interfaces targets an existing container instance in FXOS, so the instance must be deployed first; only chassis-level interface pre-configuration can happen earlier.

FMC treats the HA pair as one logical device; breaking HA first returns both units to standalone so the failed unit can be unregistered and the replacement can register cleanly.

No. NTP synchronization is needed for the replacement to form HA later, but it is not the first action; the existing HA relationship must be broken in FMC before any registration steps.

Malware events are generated from file inspection and AMP/cloud verdicts. Nothing in the scenario involves file transfers, so a malware event cannot match internal IP connections to an EDL-listed host.

The EDL supplies the set of known malicious destinations that the connection tracker conditions compare against, so only tracked connections to those listed addresses satisfy the rule.

Cisco's inline pair configuration requires Propagate Link State to be Enabled so a link failure on one member is signalled across the pair. Disabling it is the opposite of the documented value.

No. Cisco's example assigns an inside zone such as INSIDE_ZONE to the inside member of the pair, so OUTSIDE_ZONE is not the value required on e1/6.

FMC only lets you use an interface that has a logical name, because that name is what security zones, NAT and access policies reference. An unnamed BVI stays unusable.

Not strictly. The BVI only needs an address if the FTD must route between the bridged segment and other networks; pure Layer 2 bridging works without one.

FMC only asks for the ERSPAN IP address, Flow ID and Source IP; the destination MAC is handled on the network side when the mirroring switch or router builds the ERSPAN frame.

Bypass Mode is a hardware-bypass option for inline sets and inline interface pairs. A passive interface only receives monitored traffic, so it is never in the forwarding path and bypass does not apply.

Because 'Hosts Targeted' and 'Hosts Connected to CnC Servers' are attack outcomes, not host profile data. The host risk report ranks hosts by their own risk scores and attributes.

From Analysis > Reports using a risk report template, then run it against a domain. The generated report shows the attack, host, and CnC headers listed in the question.